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(57) Abstract: In an input process, a circuit and an 
input bit to the circuit are inputted to a plurality of 
computers. Firstly, one of the computers performs 
calculation and transmits the calculation result 
to another computer. Next, the another computer 
which has received the calculation result performs 
the next calculation. Thus, calculation is performed 
by one computer after another. When all the 
computers have performed calculation once, the last 
computer which has performed calculation transmits 
the calculation result to the first computer which 
has performed calculation. After this, calculation 
is performed by one computer after another and 
the calculation result is transmitted to the next 
computer, thereby repeating the calculation of each 
cycle. Thus, it is possible to realize calculation 
of a value of a given function by using a device 
including a plurality of computers, with a more 
simple configuration. 
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RESULT OUTPUT PROCESS 
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Mm* E q Tf&SWRflHU O £ E (DiSPSJl j±u G(#0)£ E ±<Dj£ 

-t£>£fr<=> Z/qZ±^(D¥ft£ cp dr-f-So cp (is ^<£{t<£^F B W+#(c;*:#l,^tf> 

Z/qZ(D5l*. G£»RffifaJta>j&fcLfc£#* G©hM$[h]G tit. 
[1BJS] 

[AAffil 203,312] 

EIGamal Bf-^S:^il^ST?f*1tfS^^¥ISi: ^tiHSflMS^^ifcoT , -x— £ 

a>4*llfl£8rt»a>li*£fT3 (309) o 

=fe,# H=[h]G Z/qZ (Dtu h *^&&l^>S:ffilRffi«Si±(D^i H £5*5£-r£o -tl 

z>o>m e, g, h, <p 301 ^pf.Sxo z^Lt>iifet>^i:to^r(Z)fh^eic*& 

LT*J< (01 30 100) o 

®ttf©1»*»t/i/xxA©«I^W*3&<±ra)tt-J|:««i=A***i* (Hi 3<c 
iODo 

{br kJ € {0,1}} k = m + I(3=i a " 1 1(3+1 m + Ip = i a lp 

&Atl-rZ> m 1 3<D 102) o 

[EIGamal Bf^-Simii^il 200,303] 
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JfcCl* Eleiz^^^L^Jc^lc. EIGamal Bt#^2giiM 2 O O^ffft^ii*. - 
CD EIGamal Bg-^sfMi^Jl 2 O O ICO INT . M^P$H[c^-ril]7fcJ:t;ill8^ 

#I+»^m^ a )[*s ±X(0 k=1,...,m+ru £TCDb e {0,1} IzM LT. >f— h*«$l 

x(«) b CkD e R E 
£R Z/qZ 

£-#*1#;&Ic3e/&L (11170 103), £TCD k=1,...,m+ru £TCDb e {0,1} |zg§ L 

x ( a ) b Ck]=0(x( a ) b Ck]) 

£T(D k=1,...,m+ru :£TCDb e {0,1} Izgi LT. V— h£f?0®t 

Y( a ) b [ k ]=[x (a)b CkD]G 
z (a) =[z (a) ]G 

££j£L (HI 7 CD 104) s #t+^Eu a I£#g(D£l&Lfc^- h^P*B£I£^-;h^*Ls 

■rt^^tt^ffl^T^is-r^ (E7izfc(t§ i05) o ap«*»ji -ei^M-r 

WVXtmmWu^) it. ^-Y^CkD.Z^lcP LT x( a ) b Ck],z (a) CD*qltCDIIElE£. 

A CDTJ&lz^oT. K^lflMcDiE^ttllBJi: (El 7 lzfctf-£ 

106) U 4*S8 (HI 7 CD 107) ^-£o 

k = m + 1 + Ip = i a_1 lp,...,m + I(3 = i a lp 

fzHfLTs XtlZfttzb rkj € {0,l}£ffl^TA;^-t-CDTOii 

x~ b rkJ Ck^ R Z/qZ 
£-^SfF3|lz£j5JtL (HI7CD108), A7Dy— KCD^IM 
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v~b rkj Ck]=[x ~b r kJ[k]]G 
Y ~b r kJ ni^H.Y-b rkj Ck;] 

££j&L (1117(7)109). ^TCDk = m + 1 + Ip=l a " 1 lp,-,m + Ip = i a lp 

-r-g. (0 7© 110)0 

#H*T, tfr83£«U(a)l±, #klziLt, b Tkj =0. b Tkj =1 left L 

Y ~b r k j [k] = [x ~b r k j MG ££ X ~b r k j Ck;i 

«(DIESttlEW4:LT^ (H7<0 111) U 2*f& (H 7(0 112) 0 

{Y( a ) b Ck],z( a )} a =l,...,A 

(0 8© 113) „ £TCD k=1,...,m tlt(Dbe{0,1}l:lLt, 

Y b Ck3 = Ia=1 A Y (a)b Ck] 

z = z a=1 A z( a ) 

(IH8<D114)o 

^T(Dlt^e{u a ±T0k=1,...,m, ±XOz e {0,l}lc§i LT. 
r^kepZ/qZ 

^-ii^l:4tLt, £T© k=1 m s ^T©b,c,£ e {0,1} [cH LT\ *SH 

EIGamal flg^frxUcTBf-^lb^ - <t t?> 7 s - Ki^lW^X 

(c( a ) bce Ck],D( a ) bc£ Ck]) = ([r( a ) e Ck]]G,x( a ) e Ck]+[r( a)e Ck3](Y b Ca+Y c Cj3+Z)) 
££j&L ( HI 8 CD 115). ^tib^^H-T-g) (El 8 CD 116) 0 <IU H G Ck] 
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IcttiB^w CO t w Cj] rfXtlZfo&t-t&o 
#tt, f*lf*i©kl:ggL-C, £TCDb,ce{0,l}lcgi]LT. fflR EIGamal Bt 

(C ( a ) bc0 Ck],D( a ) bc0 CkD) 
<P«#tt*36<H - £ s **i?*i<D k LT.^TCDb.c e {0,1 }j=H LT\ 

HR EIGamal HS#S: 

(C (a)bc1 Ck3 , D ( a ) bc1 Ck]) 

(0BS#S:a>jE^14SE^i: LT^EJ&L (HI 8 (Z) 117) „- <tkm?Z> <M 8 (7) 118) 0 
£T(D*1-J?3£11{u a }l*£-£, £T k=1,...,nu £T<Db,c,M,v,5 e {0,1} LT , 

(ACO)bc Cl0ju v ^jeffO-ocm ,„ ,4 ) = (0.[e]G) 

CCc<°>«b* Cl0/i y ^,D(0)«bc Ck ^ fV ^ ))a?=1 A =((c(^e Wl D(«)bce [k] ) 

(@8fl)119) 0 §U 
e = ((bDp)@G rkj(cnv))D?. 

£T<D*t-Jfg5fE{u a }[*, ±T<£k=m+1,...,m+rk ^T0£e {0,1} lc|| LT 
r~( a ) £ k e R Z/qZ 

£-#2ffifl=;&|-:£j&L. ±X<D k=m+1,...,m+ru ^TOb,£e {0,1} HFILTlSR 

EIGamal Bt^sC^ffll^Tv A*©!®** 

( c(a) b ^ Ck ],D( a >^ 

(ei 8 <d 120) s ^*i.&££«r& (m s(D 121) o ffitrcs ^fti©k 

iz^LT, ^rcDbG{0,1}lzPLt> «H EIGamal Bf-^-S: 

(C (a)bc0 Ck] iD (a)bO Ck3) 
<DW.^$£m:tfmClzt < i:Z)Zt. 3:*i?*i<D k IdiLt; ±T(Db e {0,1} leP Lt, 
4fn EIGamal Bf-5§-:£ 

(c( a ) b1 [kD,D( a ) b1 Ck]) 
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ttMtLt4)SL (0 8(7)122). ^^-T^ (HI 8 (7) 123) 0 
£T (7) Steffi {u a } £T<7) k=m+1,...,m+ru ±X<Db,Z, e {0,1} lcP LT. 

A;fr(7)B^3:!$SiJ-x-£ <7)Bt-5§-S: 

££j£-r<5 (IH8CD124)o ffiL£=bD§. 
^:T(7)ft^m{u a }[^gs £T<DI33S& k=1,...,U ^"TCDb.e <= {0,1} izM LT. 

( A t(0)b Ck;] ^ ,Bt(0)b Ck:) ^ ), &=& (Ol £ ]G ) 

^^J^-r-g) (H8(7) 125) 0 jILe = bn§. 

[il^B^Bt^II 201 — hBf^^g^^BBt-^-] 
&|C S U6l::^£*L<£><£?f^ 51^«^HBt-§-MiM2 01 WcCt^H-So -<7)31 
^e^WBt^il 2 o 1 to^t, M^Piffllc^-rEl 9 cfcrJEl 1 2 

a=1,...,Alc^LT)IIS(c s f+»^H u a f*mTCD^JI ((Hi 2(7)304) £*t? (El 
9(7) 126) „ -(DM-^it^SUfc. a^lc^gSWfglx^iS^ffllNT^^-x 

— (mi 2(7) 310). m^mLtz^—^^mm^m^^m^x^m 

& (01 2(7) 311) 0 A^|(7)I+^ffilCl«#7b^A6i=>tiT*5y. ^tl^frmiM- 

^m^— £ ^Mf-r^cn*. c(7)i+^«c): y jbimmtfm<Dtmm±xtfT-$<D 

[Bg-^lstffflail] 

u a l£. k=1,...,nru :£"C<7) p=1 A. ±TC7)b,c,|j,v,$ e {0,1} IcH"^ 

A(«- 1 ) bc Ck] p,v,^,B^ bC Ck] M^.C^^Ck] M)V> ^D( a - 1 )P bc Ck] w£, 
±X<D k=m+1,...,m+ru ±X(D p=1,...,A, ^"C(7)b,^ e {0,1} l-IH"3~<?> 
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A^-WciO S.B^tk) ^c( a -DP b c k 3 5l D< a " 1 )P b Ck3 %, 
±T(Dk=1,...,U ^T(Db,§e{0,1}|=||-r^ 
AtCa-Db^ 5iB t(a-Db Ck3 ^ 

(H9(D151)„ 

u a ld\ #ffi^(Dfi^-Ma>a^{TT(k)e R {0,1}} k=1 m+n £-lfM^IC:£j£-f £ 

(|E|9(D 127) 0 

l s(0!)bc [k)/i,y 1 ^k=1,.„,m;b > c,^yi e R{0,1}- 

{t ( Of ) 0 be ^ ^ ^ ^ ] k=1 m; ^ = 1 p _ b c ^ ^ eR{01} 

[ s ( a g j k=m+1 m+n;b ^ e R[0 1}l 

lt ( a ) & b Cl0 ^ ) k=m+1 ^ p =1 A ;b ^ e R {0J> 

^CkJ^^I.-Jib.esRto.l} 

£-^M^I~£j£ir£ (®9<D128)o 

±X(Dk=1 rru -£X<D (3=1,. ..,A. it©.b,c,|j,v,§ e {0,1} fell LT, 
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e> ( a > * bc Ck^ , v .£= d( bo Cia.fi □ jcffl. v □ *G>.£ □ ;r (k) 

V- hfBffi«£S&Lifl©^tLfc^— *££j*L (HI 9 CD 129) N 
±rC0k=m+1,...,m+n. ±X(D 0=1 A, ±TCQb^ e {0,1} 

=B<a-1)b CkHD7c(k)+[s («)b [:k ^ ] ( Y '-b Ck3+ z) 

D (aO* b Cl0 ^ = dCh-1>* b Ck3 € D x (k) +[t ( aOb Cl0 ^](Y~b Ckr z) 

<h> A^COBf^^S^LWt^bL/c^r-^^^JiJcL (0 9 CO 130). 

[fcB 2j COBt^COS^ <t WBf *§4b] 
£TCD k=1,...,U ^TCOb,^e{0,1}lcPLr, 

A-K a )b w ^ A t( «-1X» Ci0 ^ n fW f [stb Ck] 
t. tB^COBf^^M^L^Bf^bLfr-x-^^^JtL (09CD131K 

mWktmm^itoiEmi&mm ^rcok=i,...,m, ^rcop=i a, ±rco 

b,c,M,v^e{0,1}[zp-r^ 
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{A^CIO M,v,t.B (a)bC Ck] M^.C^Ck) ^.D^^CIO M,v,S> 

it(Dk=m+1,...,m+n, ^X(D (3=1 A. ^tOb,^{0,1}Hit§ 

{A^CkJ *;,B< a > b tk] ^.C^Ck] *,D< a >P b ClO U 

RU±X(Dk=1,...,\s ±X<Db,$e {0,1} fzli^" ^A t(a ) b CkD ^,B t(a)b W 5 * 
u a+1 f-^fl^" So 

h (omtismote^X t Ati ©RMS: £ ffi * (DBt-^-S: «fc coffiH t m%mt<DiEm^ 

UB^Lt4)SLWI) (@9©132)„ 
[^mtb*M51 202,305] 

^I2 0 2i:ol^, wm&nmi^irm i o^i^leu 2&0mLxmmir& o 

mtmnOffiX&fi? (EI1 2 CO 312) 0 #gH]S&COtB;fr (Ell 2 CO 306) 

^aiMI. (H 1 2 CO 313)o 

[¥- Mi^CCO^^] 

C0l+^fi{u a } a=1j .. m a £T COk = 1 , m,b,c e {0,1}, (3 = 1 A 

lent; 

A*( A ) abc CkD000 =[z( a )]AW bc Ck]000 
c +(A)apbc Ck;i000 _ [z (a) ]C WI 3bc [k]000 

V— h^i^MI^Ls !SSS*^BSL (IS loco 134). ^rcof+IPgg 

{>Ja}a=1, A ^:TC0 k =m + 1 m + n,be {0,1}, p = 1, A |zH LT 

A*^ ab Ck]o=[z( a )]A^ b Ck]0 

C*^) a P b Ck]0=[z (a >]cWP b Ck]0 
t, A^COB^S^gP^-^U *£££4*BiL (E10<0 135). ±X<Dtt»&W 
{u a }a=1,...,A^ k = 1 lb 6 {0,1}|:HLt 

A+*( A ) ab Ck]0=[z (a) ]A + W b Ck]0 
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\ti*KD^X&Uft1M.^Ls 1fem&'£m-t& (i1 0(D136) o 

■?%> (H1 1 OCD 137) 0 
[¥— M£-S§-:£<D£j3jc] 
^TCDf-HH^SI*. ££>I^±T(£> k=1 rru ±XO a=1,...,A, ^T(Db,c,e {0,1} Ic 

A bc CkD = A^ bc Ck3000 

Ck]000 - la^A^^^CkllOOO 
c abc Ck] = cW abc CkDooo 

D abc Ck] = DW^CIOOOO - I a =1 A C :,:(A)a|3bc Ck]000 
ikXCD k=m+1,...,m+ru ^T0a=1,...,A, ^.X(Db <= {0,1} IzH LT. 

Ab Ck3= A(A)b Ck)0 

Bb^BCA^-z a=1 A A=KA)ab [k:|0 
C arb CkD= ca)ab Ck]0 

D«b CkrD (A)Qrb [|00 . Za=1 A c *(A)G f ^b Ck - }0 

&s ±X<D k=1,...,U ^T0be{O,1}tlLt, 
A tb Ck3=At(A)b j;k:|0 

B+b Ck] = BtU)b Ck)o- a+K^^DOo 

^f+Iiiu^li, ±r<Dk = m + 1 + I Y= i a - 1 l Y ,...,m + I Y=1 a l Y .^T(D (3=1, ...,A 



27 



WO 2005/071640 



PCT/JP2005/001437 



(CULT, b Tkj &m^-?&^tti:< 

x b (j8 ) C|J =Di 8 br k j Ck;{ _ [ x ~brkj Ck;j ]c^ brkj Ck3 

££j£U 4*B8?-& (i 100 139) o :©&MLfcf-: $u*A*ja>Bt-^:$:£^§ 

^:T(DI+S^ffiu a [i. it(Ok=m+1,...,m+n, £-C<£> p=1,...,A ClLt, 

Y m r kJ M=[x K% ]]G 
*»Bt4CfC» A*<DB&#S:G)lt#a>IE^tt*«iffi"r« (EH 0(D 140)o <I 
U * LG b Ck] = 0&£>£ k =0,G b Ck3=G^:t>ek =1^^"-So 

£T<Dltir^Bu a l£^*i€*U ±TOf— h G kk =i,..., m lcPLrM^|ii#|^ 
■ ; etLf)(DA^I^^.^±i*^JaTCDcfcalC^i6TL^< (Ell 0<D 141) 0 Cft^HjE&fl) 
ffiOJliItfcS. <!L^— h Gklcl*^— K Gji:^— h Gj (DfcB;tl^ A *J 

^■CCD |3=1, ...,A ICP^LT, 

g b c k rBbrijbrj J(;kr [Z r=1 A (x (r)brij Ck:) + x(r)brjj [k:| ) 3 Abnjbrjj^ 

x b <P) ti0 =DiS brij b ru m _ iZ r=1 A(x<r)bru [k3 ■*( rfcO^ C 0 bOi bOj^ 

£2fc& (Ell OCD 142). p=1 A (CULT, rkJ CkJ = [x b(p) [k;i]G 

£ (HI1 0<£> 143) o <IU & LGhxi =0&t>£k =0,G b [k]=G^e>£k =1 
±fE*aii£fr ofc klclILT, b r k j = e k 
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±X<D1frM&W.Ua £"CCD k=1,...,l I^H Lt, 

Gt Cl0 =Btbrkj Ckr [i r=1 A (x cr)brkj Ck3] a^ki^ 

(HI 1 OOD 145) o 
^TOOIUa^i,..., a IS^ti^tU k=1,...,l CiLt, 

A+*ClO=[z (a) ]A tb rk J[ k ] 
^Lt (0 10(0 146) (EM0C9 147) o 

m&<DM.W£.f&t (H 10 CD 148) LT^H-f-i) (El 1 O CD 149) 0 

fr«=>mS§<Dtt!:*l ( HI 11 CO 306) %$ltbZ> (HI 1 OCD 150)» 
k=1,...,l ICIIL-C. G J> [k]=0^bKb Tkj =0-efeU. G^tk] = G £ *=> (i b Tkj 

=1 -e&^o 
[Hie&ra] 

[SiJIBizSA] 

EEE#(ff-JW u a (±. ±TCDk=1,...,m+ru ±TCDb e {0,1} izffi LX , 

x ,(a)b Ck] e R Z\qZ 
z'^Ck^RZXqZ 

Y'^Ck] e [x-< a ) b [ k ] ]G 
z ,(a) = [z ,(a) ]G 

££j£U ^TCD k=1,...,m+ru £TCDb e {0,1} LT. 
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x " (af)b 00 = 6 * (a)b Ck3 +x<a)b CkD mod q 



z <a) = e z (ar) + Z '(ar) mod q 

&o iitm%lt. £T(Dk=1 m+n> ±T<Db e {0,1} lzM-f& 



a = Hash (E.G,{YCa)b (:k:| } k=1 _ m+n;bs0 f1 . ZC«>. {rC«)b [|0 } k=1 m+n;b=01 . Z <«> ) mod q 

bc"<«* Ek3 ]Q = CO ] Y(a)b [k3 +Y<ar)b D0 
[ z "(ar)]G= 0 z(a)+z<a?) 

[SiJIEizS B] 

#SEE#(§|-«) u( a >l*, ^T0k = m + 1 + Zp =1 a - 1 l(3,...,m + I ( 3 =1 a lplcr 5 | 

LTs SttLfcb rkje{0,l}(Z^LT, 
x~' b rkJ Ck]e R Z/qZ 



Y .(a)b Ck:| z .(a) z (a)b Ck;) z .,(a) 



Y ~'b TkJ 



CkD=[x 



~'b fkj, 



CkOlG 



gbrkjDI 



Ck) s rZ/<iZ 



x ~»brkjD1 



Ck] s rZ/*iZ 



Y~'brkjD1 



Ck) = ^" brkJ n 1 Ck3 to ~ C 6 bfkJ D 1 Ck3^ Y ~ bI " kJ D 1 
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u a (£. £TCDk = m + 1 + Ip = i a_1 1 p,...,m + I p=l a lpl^PLT. 

6 Cl0 = HasKE.G, lY^OO^OO 1 ^ ^ ) mod q 
0t>rkJ CkD = °l\0 ~ 0 brkjDl Ck] modq 

x ~" brkJ CkD = 0brkJ Ck) x ~ brkJ CkD + x "' ,brkJ CkD mod <i 

SElJB#u a l±. £T<Dk = m + 1 + Ip =1 a_1 1 p,...,m + 1 p=i a lp, b = 0,1l=HTl"* 
Y~' b Ck] i e°Ck],x~" b Ck] 

k = m + 1 + Ip = i a_1 lp m + Ip=i a lp,b = 0,1 

0 M = Hash(E,G, [Y~b [|0 , Y*"b [k;i ^) mo d q 

0l Ck]= e Ck3~ e °[k] mod ^ 

k=m+1+ Z ,~.m+ 1 ^ = -| a I £ , b=0,1 
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^ b [ k )]G = [e b ck)^Ck] +f ' b Ck) 

Y~° W +Y ~ 1 CkD=H 

[SUISSE C] 

IEBJ#(I+^#) u a i*s ^T(D k=1,...,m, ^rTCD £=0,1 IcHLT, 
r .(a)eO [k;]eZ/c|Z 

p(a)e0 CiO =!> ,(af)e0 tk>lG 
l<a)«i 00 = &Kflf)el Ck ji(Yl Cl3 -YO EO ) 

0 C«) [k3> = Hash (E,G, t C(«)bc £ ^ rforibo b [|d ^ m;bc £ ^ , ( pCor)e 0 [k)i 

,...,m; e =0,1 > 

r " (0f)£ DO 55 0(Qf) Ck] Ck] + r' Caf)£ Ck] mod q 

££j$-T5o UEBJ#I*. k=1 m^£=0,1 icp-r^. 
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4*tE*l*« *kttl=-t*i€*L<De«0 l 1. k=1 m IcfULT, ±X<D b,c=0,1 lc 

&C0f) Ck> = Hash CE.G. [ C<oObc s ^ D C <*>bc £ M } R=1 m;b , Cf e=0tl , I F<«> £ ° Ck > 

F( a ) £ 1 Ck> |K « ) e l k=1 ,._,„, E =0 ,1 ) 

&£.m.-t&o t^t© k=1 m&t^O.I izm^x 

[r"( « > * Cl0 :iG = [0 ( *> Cl0 ] C< «)00 e M + f< « ) e o C|0 

[r'< « ) E W ] { Y1 G) -Y0 0D ) =[ 0 ( « ) Cl0 ] (DC « >01 £ ^ - D ( « X» £ ^ + F< « > * 2^ 
e w ] (Yl co -YO Ci3 )=[0(«) Ck3 ]( D («)1O « w HDCaXJOe^ + FC^cl^, 
(D(Qf)H e Cl0 -D(«)lo e^sflaCaXW e [|0 _ D Car)00e [|0 ) 

D] 

BEW#(tt##)ua I*. ±T<7>k=m+1,...,m+ru £T(£> b,e=0,1 \zM LT, 
r ,(a)b Ck]eZ/qZ 

F C of ) £ 0 Ck3 = [ r ~< or) £ Ck;) 3G 

££j*"T5o £?>[^> t£T(Dk=m+1 ) ...,m+n IcFJLT 
0 (.«) C|0i B Hash (E,G, I * Ck 3, D<«)b e w . F=C«* £ ^ lk =m+1 _ m+n;bj e =0r 1 ) 

&.\z s itOk=m+1 m+n. it©b,£=0,1 dglLT, 
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r ~»( a) e Cl0 = o ( a) M fia) e [(0 +r ~< or) e ^ mod q 
&£.J&ir&o KEBJ#I*> k=m+1 m+n S-tf e=0,1 I^H"^ 

F ( flf ) £ o [k>F (a) £ i [k>r -(a)£ Ck] 

±fBiEBj(7)^ii^}*ii^T(Diiyo mmz*:*i^M e=o,i. 

k=1,...,m IcPLT. £T<7)b=0,1 [c^-r^ 
c(a)be CkD 

0 Ca) Ck> = Hash (E.G. I C(«)b e Ck> ^ Ck> F«*>b £ M Wl,....m + n;b ( e =0.1 > 

#Uc s t^<tfl)k=m+1,...,m+n R^£=0,1 Citt 
\/"< * ) * w ] G = [ 6 < « > (10 ] cC Qf )0 e ^ + f< or ) £ 0 w 

[r~"Cff) ^ Ck3 ] ( Y~1 QD -Y~0 03 ) <9<><*\ k j} (D(«)1 * Ck3 -D(«»e Cl0 ) + F<«>« 1 W 
[J3ijlE5& E] 

a=1 AdP^LTJIISSI^ tm:#u a [*J2lT<D«tS*fTdo 

u a (& N 

*h=0,1/3,2/3 v ia ^Ww.€= li.V.t ™*q 
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{ a ( <x-h)bc m w^.Tta-tiftboQQp^^; } k=1 m . p =1 A ;h=2/31 / 

3,0;b,c,^,v.^e {0,1] 

$Z/qZ^e > -^#a.(^®U\±TCDk=1 I ... I m, ^TCDb.c.^v,^ e {0,1} LT , 

D ( a -2/3)/S bc^ y ^DC^bc^^ „ ^ +[r ( a -2/3)^ 

A «*-m)bo m/i y ^=A(«~2/3)bo [k:i ^ >I/a7r0) ^ + Co-(«-1/3)bc Ck:)ju ^ 

B«*-1/3>bc C|0/i y ^ =B («-2/3)b C|:k ^ iVn7r0) ^ + [a(«-1/ 
3)bc Ck]//,V^^Yb Dr YC 0r Z) 

CC«"1/3)P bc Ck ^ y ^ = C C"-2/3)/J bc Ck;]/i >yajrfl)itf +[r C«-1/3)^ 

D (*-1/3)0 bo [k3M >v £ =D C«-2/3}* bc^ fynx0U + [r<«-1/3)/3 bc^ y ^] 

(Yb C0 +YC G3 +z> 

A ( a)bc CkD j, . v .£= A<«- 1 /3)bc Ck3j[i iy n 7r(jU+ [flr ( ^oo^^^lG 

c (a) * bc Ck3^.£ b C[k:)ju vD7r(jU ^r^bc^ 

D (ff ^ bc tk^,v^=E> (a - 1/3 ^ bc tk^.vD*(j),£ + ^ CQf)/Jb °Ck]^.^ 
^ Yb Ci3 +YC 0D +z) 

£Ttf> k=1,...,iTK £TCD P=1,...,A. £T<D h=2/3,1/3,0. ±X <D 
b.c.M.v.Se {0,1} [CULT. 
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£ Z/qZ frP>—&mft&lzMTf,±X<D k=1,...,rru itO p=1 A, ±X(D 

b,c,[j,v,^{0,1}l:lLT, 

A<«-2/3)bc Ck;jjr{|)// v ^ = A(«-1)bc Ck ^ nw(0 ^ #+[ff <af-2/3)bc Ck:i ^ y ^ G 

c <*-2/3>£ bc Ck:)7c(i)// y A ^^-W^iiUTt^v £ *£r 
D <*-2/3)0 bc W3r(i)/i v iS ^)^bo il0fiDjt{i) y ^ +Er <«-2/3)* 
A<«-1/3)bc Ck3?r0 ^ p ^=A(ar-2/3)bc w ^ yD ^ 0)#+[tr < O! H/3)bc Ck ^ ^ 

C «*-1/3)/J bc Ck3w(i)/| y ^ = C «*-2/3>0 ^ mpt vnm$ +[r <«-1/3) £ 

bc Ck^,v,^3G 

bc CkDju^^l^CO +YC ar z > 
A<a)bc Ck)*(k)*.^=A^^^^ 

B^tlOKCk)*.^ =B <a - 1/3)bc Ck3 J u, J /n 7 r(iU + 
[cr'C«)bc (k3jU ^ ^jcyb^Yo^z) 

^>* bc tiO,rCk)^,£ = C<*-1/3)/3 bc C|0j[< +[ r<ar)/5bc | . k ^ ^ ^ G 
D' (ar) ^ bc Ck^(k)^,u^=D(«-1/3)^ bc Ck3/U yn7r(jU +[r < a ) * bc Ck)jtf v ^ 
(Yb C0 +YC 0] +z ^ 

^tjIC^TCD k=m+1,...,m+ru ±X(0 P=1,...,A, ^T(Db,^ e {0,1} \z.m LT . 
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3<a)b cid ? jt .(a)b tl0 ^ 
* Z/qZ 6— tiMRft]fcl=Stf,±Ta> k=m+1,...,m+n,^TCDb,< s {0,1} l=H LT , 

B<0!)b Ck) «aoi« ■ B(Qf " 1) b cw# a^<k) + w<«* M «» r *oa«> 

* 6. I-£T» k=1 l,±XO)bX s {0,1} CULT, 

«z/qza*&-»«fc*i=su:, £ra>k=i i,*r<n b,fs,0>11 i-hlt. 

3fclC. itO)k=1,..,m, h=2/3,1/3,0 IzglLT* 

0(B) ClOjr(Dni' 
£ Z/qZ ^^-liffSCI^o 

±X(D k=1,...,m. ±XO) 0=1,...,A S it© b *' U ' S i0,1} (cH LT S 
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£ Z/qZ ^-^Sf^Kjl^o 

. k=m+1,...,m+ru it©p=1,...,A, £T<£> € {0,11 |z|§LT, 

^Z/qZ^ib-mmi^lzmS. >XIZ. ±X(Dk=1,...,U.±X(D b '^ el0 ' 1} lzmL 
t, 

* Z/qZ fr&-«Hftfls*l;:3H# 0 
^t^tO)k=1,...,m^t0p=1 A.^TCD hfitU ' v '* e 10,13 (zglLT. 
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A(Qf " 1)fac Ck) vnn®,v,£ 

B<ff " 2/3)bo CkD *a>ni./i,y.*- B Ea-<a-2/3>bc ro jr(0ni ^ y ^ (Yb C( . r Yc a3+ z) - 
[« (flf Wfi>DlJ B(a " 1)bc Ck}// ox© .v 

c e c a tt ©mi c< «-M bc Ck3 ^ a n(i) v M 

B<«-1/3)bc Ck3 7r(j)Dl ^ ^ ^ =[a KQr-1/3)bc [k:) ^ 0)ni . ja ^^](Yb [a+Y o a)+ Z)- 
1/3)bo Ck3 DtiOO 

B' (af)bc CW xOODl.jK.»'.« -[^'< a > bc Ck] ? r(k)ai./i.y,#]<Y b Ci^Yc Cj 3 + 2)- 
^ (af) Ck^(k)Ol3B^-^o Cf0 ^. v><fn7r( 



r(k) 



O ( a -1/3)0 bc C|0tf y ^ n7r(k) 

D ' <Q! ^ b0 Ck3 7r(k)ni.//^.4 =[r'<«>^bc Ck:) ^aoni^.v.^CYboji^^- 
t^«^k^(k)Dt]0<«-1/3)^ bc w n3rW 

#lc s ±t(Dk=m+1 m+n s (3=1,...,As ±TO) b ^ e(0l1) [cpjLT. 
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£ □ 7C (i) 

1)b Ck3 

$ n 7c (o 

*" )/rb w »<Doi.«-tf<^»»oo ^□i.^ Ck3+ z)- t0 (o f ) Ck:i7r(j)ni]D ( a . 



b £ e {01} 

it(Dk=1 1, ±TCD ' ' [CULT. 

£ □ 7T 0) L J 

)b Ck3^D7rG) 
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S = { E,G, 
t 

k=1,...,m:h=2/3,1/3,0;jS=1,....A; b,c.jU.v.£ ,£ s{0,1}> 
{ 

A( « )b CkK , BCa)b Ck ^ , C <«)^ b Ck] $ , D ( or)/? b^ ^ 

k=m+-1 ,...,m+n; jS =1 A ;b, 4 , € ^{0,1^ J 
{ 

AtC«)b Ck3 ^, B t(Qr)b [k ^ 
k=1._..l;b,£.£ e{0.1}i 

5fcl:: % #ua(£, ±T0 k=1,...,m+n IclLt 
0<a^ k 3 = Hash(E.G t k, S) 

£T(Dk=1 m+nlcULT 
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£o 2fcfC. k=1 m, £T<2 (3=1 A. ±X(0 h=2/3,1/3,0. 

cr'<«~h)bc [k33r(0/£ y ^ s d<«) tlOw<0 cr(«-2/3)bc Ck;3// ^ ^ + 0 -.(ar-2/ 
r"(^bc Cl0w(i)Ji v ^ =0^> ClO7r(o r(«-2/3)i? ^M*.^ + r 

b,£e{0,1} 

mz.^ it(Dk=m+1,...,m+n > ±t©p=1 A, ±T<D ClLt, 

*" (Q?)b Ck:i;r(i)£ = 0(Qf) Ck37c(O s<QJ " 1)b Ck3^ +s<oM) W modt > 
t Ktt) ^ b 00*(D^ =0(a) C^7r(O t(ff " 1 ^ b Ck3^ + t <flM)b na£ mod „ 

b.£e {0,1} 

±t(Dk=1 U ±"C(D (CULT, 

st " (Gf)b Ck37r(D^ = 0(a) Ck^(D st(a " 15b Ck^ + « WflM *0a* modq 
k=1 ,...,m;h=2/3,1 /3,0; £ =1 A ;b,c, /i , ^ , £ , £ €={0,1 } 
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k=m+1 ,...,m+n; £ =1 ..... A *,£ , 4" <s{0,1} 

A<a *oqt.«-B< <,, *DO*,#-o < " ) * b oo*.<-D< fl,) ' b oa*.#. 

k=1,....l;b,£,£e{0,1} 

AtU)b Ck3e.^.Bt<«)" [kK ^. 

mi, *T<Ok=1 m+n izmiTh 

e<a W 
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S = [ E,G. 
I 

h)/Jbc Ck3i«,v.£' 
h) * bo CkK.0.v.£ 

Jk=1,...,m;h=2/3,1/3.0;jS=1 A;b.c, ,£ e{0.1> 

{ 

A(a)b CkD 4 • B ^ }b Ck3 £ • c(ff) ^ b Ck) $ ■ D(or) ^ b CkJ * - 

A <a)b tk)e^' B<a)b CkK^' C ' (Qf) ^ b Ck^^' D ' (a ^ b CkK^ 

•*k=m+1 m+n; jS =1 A ;b F £ , f e[0,1} * 

[ 

At(or)b Ck ^,Bt<t*)b Ck ^ 

•k~1...J;b,£,£e=[o,1}l 

££|&U #uald\ ±T0>k=1 m+n HiLt 

0 ( aO^ = Hash(E,G,k, S) 
££j&Ls ±t<Dk=1,...,m(Cg|L"Cs 
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k=1, w ,m;h=2/3,1/3,G;£=1 A ;b,c t jti , V . f e[0 T 1} 
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[<r'<tf-2/3>bc [k} £ ^ ^^^^ 

lT <a-2nW bc Ck34r ^ (V ^](Yb [O+ Yc or z) = [0(ar) |:kU 3(D(a ! -2/3)^ 

t<r<a-m)bo tkU M v ^3G = f0(«) CJO ^(A(a-1/3)bc Ck;j ^ „ ^- A C«-2/ 
3)bc Ck3 /, □ £ .£> "A< «-V3)bo Ck;j ^ M v e 

[a Kar-1/3)bc Ck] ^ M v $1 (Yb ca+ YC Q3+ Z) - [0<") CkK ] (B(«-2/3)bc [k]/i y ^_ 
B(«-2/3)bc [k:i/(/ae >y ^)-B^-1/3)bc CkK ^ ^ ^ 

[zr ..(ar-1/3)^bc [|04 . fj[/il/ ^ 3G = [ e(Q ! ) CkU]( c<a-l/3)^ bc^ >jf ^- c Car-2/3)/? 
bc Ck3 W Df bc Ck34r.«^^ 

[ r •>( or -1 /3)0 bc Ck;j ( ^ ^ (Ybj-Q+Y^Q^Z) = [ 0 ( « ) no ^ ] (tf ar-1 /3) /J 
^Ck)*.^"**- 273 ^ bc Ck) ^ y ^_ D <«-1/3>/3 bc CkU ^ ^ 

[a"( a )bc [kU M v ^G^flCa^f]^^^ „ f -A(«-1/ 
3)bc Ck3 ii O <■ . v , " A< °° bc DO £ .#1 . v ,4 

3)bc Ck^ n*.v.*> -B <flf)bc Ck)4-^^.^ 

^' ,( ^ bc Ck3^,//.y^3G = [0^) Ck3e ](c(^^bc Ck ^ ^ e . c (ar-t/3^ 
[r-CoO/Sbc^ ^ iy ^](Yb [a+ Yc O3+ Z) = [0(ar) tkK ]( D («)^bc Ck ^ y ^_ D (or-1/ 
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k==m+1 m+n;£=1 A;b,£,£ e{0,1} 

■ B<a)b Ck3« 

[t'<«)^b CkU ^]G = [0(ar) CkU ](c(^b C|O ^- C (ar-1)^b ClO ^ D ^)- 

D * (Qr) * b CkU,£ 

k=1„..,l;b,£,£ « 10,1} 
(CULT 

u ffl f£, £Ta>k=1 m+n, it0b,c e {0,1} 

^roilBj#(ff^:#) f*. £-**&H«ic£ 

Z'( a > = [z'^lG be e foil 

J*U SifejfcU ±r© k=1,...,rru ±X<D b,C 10,11 . £ 

T0)f3=1 AlclLT 

47 



WO 2005/071640 PCT/JP2005/001437 

A<A)atbc C|0ooo = b <£r>, A CA)bc Ck]000 
c < A )« p bc M(m =[z -( aOjcC A ) a bc,.^ 



££«U ±X<D k=m+1 m+n, ±XO> b e * 0,1 ' . ±Xd> |3=1 A IcML 



c -( A ) a b MQ =&,•( a ) ]C ( A ) or 



b « [0,1} 



A t< A ) or b C|0o =[z < or )] A t( A >b [}JO 
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S = 1 1 A< A )bc ClO0QO , 0 < A > * bc Ck;)000 , } R=1 tm . b c=0>1 . £ =1 ^ A . 

I A< A )b Ck;j0 , C ( A ) 0 b [|0o ] k=m+1 m+n . b=0 1 . ^ =1 A , 

{At(A)b Ck;j0 J k=1 ];b=01> 

{ A K A ) or be [k:|000 , c*C A ) or fi bc MoQQ ^ m;b c=01 . fi =1 A . 

{ A*(A)ab Ck:)0 , tf(A)cr beta b Ck;)ok=ni+1 m+n . b=0 l;jg=1 A , 

[Z<«)} t 

{ A < A ) a bc M0QQ , 0 < A ) « 0 bc Ck3000 J^^^ . ^ =1 ^ A , 
[ A'CA)a b Ck}0 , c< A ) a 0 W+1 m+n:b=0(1 . ^ =1 A , 
{A t<A)a f b Ck]oJk=1 j:b=01 ,. }1 

0 = Hash(E,G, S) mod q 

z »(a0 = z (or)0 + z '(Qr) modq 
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Z< or ), { A < A ) « bc [k:)000 , c-UyaH bc [k)000 ^ 

{ A < A ) orb^, C '(A ) or £ b^ ^ m+n;b=Q ^ =t x , 

tAt<A)ffb Ck3oJk=1 1;b=01 , 

z "( Q? ) 

S = I [ A < A *o ClJ000 . o< A ) 0 bc [k:jooo . ) k=1 _ m;b c=0 , . g =1 A , 

t AtU)b CWo]k=l,...,l;b=O.T 

,...,m;b,c=0,1;/8=1 A' 

j A * A ) at b [(d0 . c * A ) a 0 ^ ^ =m+1 ._ >m+n . b=0> , . fl =1 A . 

t At * C . A)ab W0Jk=t..„J;b=0,l. 
(Z<«)}, 

l A< ^ ) « b M0> o< A ) at /» b W0 ] k=mt1 m+n;b=0 . ^ =1 A . 

(A t.(A)«b Ck3o)k=1 |:b=01 ,. H 
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d = Hash(E,G, S) mod q 
k=l,....m.b,c e= [0,1 L £=1 f .„,A 

[z »( a )] A < A )bc [k3000 = A < A ) a bc Mmo +[ q ] A *C A ) a be [|d000 
[z<«>]C<A>^e Ck]000 = c <AW 

k=m+1 m+n, be [0,1], & =1 A 

[z'< « )]A( A )b [k;j0= A < A > of b Ck]0 + [ e 3A*C A ) or b ^ 

[ z »( a)]c< A ) £ b Ck]0 = c < A ) a 0 +[ g ]c*C A ) or 0 b Ck]0 



[z'< a )]At( A )b [k;]0= A t< A ) a b [k)0 +[ 0 ] A tK A ) or b^ 



tt-Ji:# u • I* ^-ii^i^^i,, ±T<Dk=i ncf 
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A+, Ck} = ^ (a) ^ AtbrkJ Ck] 

t Ai %:) k=i I* 

61 = HashCE.G, S) mod q 
Z "(a0= 0 z^) +2 <0f) mod q 

s={{Atbrkj Ck]3k=1 

lAl *D0lk=iU' 

t At 'Ck]Jk=i 0 
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6 = Hash(E,G, S) mod q 
[ Z »( a )] A tbrkj [k) = A t' [k3 + [ 9 ] A% 3 

£«b-c * & see $ sa-r & o 
mmm 2 

;£#gB.3<7}t£2<7)||»JlCO(^-t. El 1 4#l*L0 1 8 £^1^X18^ ho 

tMtSEff 1403 &mx.x^&%<D£-r%> 0 &.Tx°itz<onmm&mmiz ui,...,un 
[■5 s — *a>SMt] 

tt*g«1401 <D U1 (4DATA00 £tt*-r<5o C*L* ro i (Dttftj i: 
J;,Sn(1701)o 

jfciz r-j*]@<Dit^:j £frdo 

U1 I* DATAo 0 # N h> DATA! 1 r^Lt> DATA11 * U2 IC$£&(1711) 0 

U2 (± DATA11 frh> DATA1 2 £t+3f U DATA12 £ U3 l^^(1712)o 
JMT]III=7 S — ^^^oT^t^> UN [£DATA1 N - 1 fr& DATAi N £fHSU DATA1N 
£U1 [zjH3(1710)o ZZ£^A<HlS0>ttSt"T*$>&o 

U1 I* DATA1N DATA2 1 £f+3t LT. DATA21 § U2 lz^£(1721) 0 
&lz U2 f* DATA21 ^P, DATA2 2 £ftlt U DATA21 £ U3 l::ji£(1722)o 
JMTJIIICT 1 *— ^ ££toTfr#, UN l£ DATA 2 N " 1 fr£> DATA 2 N £tt# U DATA2N 
£U1 lz^^(1720) o ZZ^-e3&<-JlS<Dfh^:-efc^o 

U1 tt DATA2N & DATA3 1 £ft3f Lts DATA21 $ U2 lcSI&(1731)o 
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KTFIHI^— £ £5!-o-C*t^\ UN tfi DATA 3 N ' 1 DATA3N Zti^mZ-tzt 
[#ft3f=gtt 1401 cDAtH^i] 

^ic#-t+»^fi 1401 (D-^yixy-r^f 1 — -^^Atti^^iii 1 4 £#M Unit- 
's o 

£-1+31^1401 Hl^CD'R^ 1404, fc&TSm&OSyAAtl 1402 7^A*j£ 

C C-ei*, ES^IffK 1404 tfmirm$i<OJ<tim=f-Ufr(Dm=?-CO fan-in 0>»A< 2 

ESS^A^SH 1 w^0A^] bwli U1, .... UN ©iW^iSSCBrtLT^ 
L^4,<Z><!:-r<5o U1 UN+1 <!:£»< ^d^-So 

Ul tW^IIcFJt^LT^A* tf -y K<OjfiiA<lHiK<O*P^AA'1402 i?fe§o 
@K<DW*8 1404 ^ItS^OA^i? i L^^^A^I^Aott bw £{±S 

C[1]CD^:T<D¥— h(D fan-in <£>tfcl* 2 "Cfe^o 

f^wroST, :&T£>fan-in L(w)* R(w)<t # < Wtlzf 

#ftj|igfi 1401 lC|U^<D'ltfE 1404, fc<fctf|I]S&a>SR#A:*l 1402 ^A*j£ftfc 

i=1 ,2,3 (C-fcfr U =L—*f Ul T^fS i @ (DtUfT? UI+1 iC^Hf &"T-$ $ DATAil «h 

a-r*lc-r-6o DATAi-1 N £ DATAiO «!: < £o 

*fc, H0J3@a>f+3r^U1 *^of=ti-3KDti-5t«gm$DATA01 £«<o 
DATA/ 1*, DATA' =DATAi M || BODYj' ||PROOFi' 1| SIGi' <h ^ ? Lt „ 
DATAil-1 I* UI-1 ^P>jlie>^T#7i:y «y-fe— i>s BODYil \Z* v\> — *?0)*ft. 

PROOFil It BODYil <DIEiI3l4ffiEI?HS\ SIGil I* Ul <X) DATAil-1 || BODYil ||PROOFil 

K5iJSa<OthJf(c*Jl>r, Ul l£&? DATAil-1 * UI-1 j&*&SWfc5(1501)o 
(-JSS<DU1 ©WiWWlcl^ofcf-^ DATA01 
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DATAi 1 " 1 £ IflX -otch>y. Ul l±3E^ttlEWS: PROOF11, ....PROOFI-11 
mfc? §(1 502) of LT^ICUI X SIG, 1 „ . . . „ SIGI-1 1 £ £ T ^Hf -5(1 503) 0 

US 1 Jii<Di§^t?. L^t, 1=1 (Dii^-CT;^ 1504 (DstU&ft? . 3fcl- Ul l£SLifc£ 
J*£*t5(1505)„ fLTUI(«(D5La*ffl^"C*Wff$mv BODYil £#JTr& 
(1506) o ^thS^$^xfc £ Ul [± BODYil (DIEMSttBEIKS: PROOFil £fM£f 3(1507) o 

LT Ul (* DATAil-1 || BODYil || 
PROOFil [Ztt-f&mtt SIGH £fM£-r&(1508)o 

Jl^lz Ul I* DATAi) =DATAil-1 || BODYil )) PROOFil |)SIGil £ Ul+1 IC^iTTS 
(1509) o 

[HW^sC E[27]] 

G[1]£. T — ^/Hl"^ DDH raffl^StLl^tZX^^fi^Efti^ffiRffllft^i: 
L, G[1]<7M±lfc£ P £ G[1](7)«7U^O^at-o 

P[|0|] e 6[1] 

lC*frU (P[|0|],0)^BSfBLrm(cP[|0|]tSL. ^$81= 

F p C,B[ia, G[1] C G[12B] 

<b<fr&Ls G[12B]±(7)fP$i5)c^®(DfPlCcfc ytiL, 

W [12] **B12 K 

G [12W] -G [12B]* £ir&o 

w[2] S W[12] 

G[12W]_hO)*n <!:X7J7 — iX73 7 — f&lc J= U § „ 
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• B[12]=F p U3 /U 2 -t), 

• #[24](1M, ^[24](0)-7, 

• Sp^l'SnoiiplllOll-HiLllllPCll 13, aat|0l3P*Eml*aLn HPaLlOll) 

• W[12]=B[12] 

m e[|i|3=(0,-,0,1,0,-,0) (i#@tf><&#1) 

• ^[2] :F p -*W[123£x — #[23(x[|«l3)e[l«|] 

• PC2]=(P[|0|],P[|1l]), P[23]=(PC3|0|],P[3|1|]> s 6[12BL 

' a=a[!0|]+a[|1|]77 €= B[12], P[2]= 
(P[|0|],P[IU3) ^ G[12B], 

• k : pWtf-y h-^, 

• x=x[|k-1|] 11 - II x[|0|], 

• Gt12W]=G[12B] 

B§^3C E[27](£ G[12W]Ci *SR EIGamal i^UKftlffcS, 

3&&ft£IH£ Fp^HMiffillll* G[12W]2.¥:*:£M£ G[l2WJ.£L§S£(ffl£ W[12] 

m*km&Tfz>i-te* p=p[|oi]+nP[|iii^ p[\o\ip[\wo tt£z>*,<D&&mKm& 0 

^V^AI- 3 e Fp Q=aP tir& 0 a ^IKtttts (P,Q)j6<^IIB«T?**. ¥ 

r B[l2l 

(P[3],Q[3])=(rP,M+rQ)$ti-|t-r^o(P[3],Q[3])Sta^*l=(* Q[3]-aP[3]£ft3Tf H 
lifit^o [Bt^St E[2],Et25]] 
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• K[l]«| |x[|WWh|]}(wec[1],We|L,R},h€{0J}*^S) | x[|wWh|]eF F 

• A[12]={ { a[2|wWijk|3} ({wecEl],We{L,RKi,j,ke{0,l}}^^S)|a[ 

• A[125]=f 1 A[25|«iWijk|i[6]j[6]k[6]](iwec[l3,We{L,R},i,i[63,i, j[ 

lA[25|WWijk|i[6]jt6]k[6]]ewLl2]} 

• G[1|K|]={ fPClwWh]]) (iwec[1],WslL,Rl,he{o,in ££3) IPUwWh 

• G[12|A|]={{ P[2!WWijk|]} ( W GC[1]jeiUR), i, j,ke {0, 1} } ) |P[2)wWi , 

• G[124IA[]={ i P[24|wWijkli[6]][6]k[6]]} 
({wec[1],W^ {L,R|,Uj,k,i[63, j[63,k[6]e{0,1}} 

|P[24|t«Wijk|i[63j[6]k[633eG[12W], 

• aA=(aA[|1|3,aAt!2l3) 

• a[53A[53=(a[53A[5|1|3,a[5]A[5l2|]) 

m a SAD 2] 

• A=(a[|1|],A[|2|]) e G[12|A|3 2 

• a [53 e A[125] 

• A[53=(A[5|1|3,A[5|2|3) ^ G[124|A|3 2 

k (Dtc x (D wWh mftZ x[|wWh|]£#<*l::U A[12]<Dte x[2]<D wWijk J$#£ 
x[|wWijk|] tm<m (3 L . A[125] (O 7c A[25] (7) wWijk,i[6],j[6]{},k[6] # £ 
x[|wWijk|i[6]j[6]k[6]] «b # < VIC-T ^g, 0 

A[125]0)7t;I^±(D«. t£ G[124|A|]CD7uC7) A[125]CDtc(Z <fc ^— -fg 

• a[253*b[253 = Z i[7]J[7]ik[7] 

a[25twWijk|i[73j[73k[733 

b[25l«Wi [7] j [73k[73 I i [63 j [6]k[6l3, 

• a[253*P[24]=Z a[25|wWi jk| i [73j [7]k[733 

P[24|wWi[7] j[73 k[73li[73)[73k[733 
(i[73o[73A[73^TS*U) 

jiTF<£>fs-s§-£:£«-r<5o 
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• E[25][{Z[2]|s[25])](M[253) 

]EC27][(Z[2]|sC25iv*iik|K63i[6]k[6]])](W[25|^iikiiC6]j[6]kC6]3)! 

• E[25][(Y[2]|s[25])](M[25]) 

E[25][(s[25]lZ[25])](M[25]) 

• E[2][(x[2]|r[2])](M[2]) 

|E[27][<x[2|wWijk|]!r[2|wWijk|])](M[2|wWijkl]) 

• E[2][(Y[2]|r[2])](M[2]) 

i[2][(x[2]|r[2])](M[2]) 

• M[25]=|M[25iwWijk|i[6]j[6]k[6]]}, 

M[25|wWijk|r[63j[63k[633 e G[12ff] 

• Z C2] = {Z [25 1 wW i j k I i [6] j [6] k [6] 3 K 

(Z[25|wWi jkj i [6] j [6]k[6]] e G[12W]2) 

• s[25]-is[25lwWijk|il6]j[6]k[6]]leA[125] 
« Y[23=(P[23,r[2])«=G[12W3, 

. • Z[25]={Y[2]} [IwWijki i[6]j[6]k[6]3 

• MC23=lM[2|wWijk|]][|«fflijk|] (M[2|wWijkl3 e G[12W3) 

• x[2]=(P[23,Q[2])={{P[2|wWiik|]}, { Q[23 

[lwWijkl3}) 

(P[2lwWijk|3, Q[21wWijk|3e6[12W3), 

• r[23=|r[2|WWijkl3K r[2]wWi jk|3e }}W[123 

Bt^^ e[2], E[25]^^tL^tLs mmmmm±<D&m%zm^)i'ji^)\'^<. n 



• h[:i|wi3(ijk))=(0[|w|3i)0k 

• F[25:l| A [)1|3, AC12I3* A[|2|]|3(x[23)= 

ix[2:l|wh[|w|3(ijk)l3 
5(i,i[6]OA[|1wl3), 
5(j,j[630A[12wl3), 
S(k,k[630A[|3w]3)} 
(wWi i [6] j j [6] kk[63 \zMt SS) o 

• J[2](x[23) e A[123=J[23(x[23) = {x[2|W(w)i[W3l3. 

• 7rt23(a[253)={Za[25|wWijk|i[6]j[63k[6]3}[|ijkl3} 

m&ilS], j [63 , k[63£!irf3*n) 
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• A[|1|]=;U[[1w|3K A[|2|3«U[|2*|]K 
A[|3|]=UC!3w|]} : !f>y b(DMo (w^P [1]Cit5I) a 

• x[2]={x[2iwWh|]} x[2!wWhf]e W[12], 

• rn[iwi]j •.m^wtm-rzmw.i'o 

(7t^Lw^A^^m^iD[lw|]i-1(if b^\} v 
V^CD^-fftfrtm-oT^Z), iD[Iwl3j-0 (othewise) 0 ) 

• a (i, i[6]) : ^P^-y^-CO^^c 

• i[W]=:i (if w=L), i[W]=j (if w=R), 

• a[25]={a[25iwWijkli[6]j[6]k[6]]} e A[125] 

• (a[25]%[253)c[25]=a[25]*(b[253*c[25]) , 

• (a[25]*b[25])P[2]=a[25]*(b[25] |}P[23), 

• F[25:i| A[3l1|3, A[3|2|], A [3|3|]|3(D 

*F[25:ll A[|1|], A[l2l], A[l3l]l](x[2]) 

F[25:l| A [3|1 1]0 A [|f|l, A [3|2|]0 A [|2|1, A [3|3|]0 A [|3|] |](x[2]) 

• F[25:l| A[|1|], A[|2|], A[|3t3l3(x[2]) 

*F[25:l|0,0,0|](x[23])=F[25| A [111 J, A[|2|3, A [|3|] |] (x[2]Ox[23]) 

0 a[253,b[253,c[25]SA[125], 

• a[2],b[2]eA[12], 

• x[23,x[23] <= 

• A[|1l3=U[l1w|]j, A[|2|]=|A[l2wl3} 

A[|3|]={A[|3w|]}, 

A[3in]=u[nwnu 

A[3|2|]=|A [|2w|]K 
A[3|3|]=|A[|3wl3l \£<9 h<T>&\ 

• I €= {1,-,Nl 

Lmommotmmm} 

ui t^bodyio &§t^&?5& : £mm-?&o 
ui iij^T^st^-r^o 
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• x[:0|wWh|3=0, 

• x[2:01WWh|] 

^[2] (x[:0|wWh|]), 

• x[:0] 

7x[:0|wWh|]}, 

• x[2:o] 

ix[2:0|wWh|3K 

• A[:0]=iA[:0|w|]={o), 

a [L:o]={ a [:0|L(w) 13= lo} , 

A[R:0]={A[:0|R(w)|]=|0}, 

• r[2:0]-lr[2:O|wWijkf]} = {0l (wWi j kid HITS JK> 

• y[:0]=0, 

r[2:0]=y[:0]P[2](=O), Y[2:0]=(P[2], r[2:0]) 

• s[2:0|S|]=Ks[2:0|S|])|;iwWiik|i[B]j[6]k[6]3} 

= ^0}[lWWijk|i[6]j[63k[633, 

• s[2;0|T|]={(s[2:0|T|])[|wWijk|i[6]j[63k[6]3f 

= 10} [|wWijkli[63j[63k[633, 

• s[25U:03=l(s[25U:0|WWi jkl i [63 j L63k[633l 

= {0} [|wWijk|i[63j[63k[6]3, 

• (S[2:03,T[2:o3,u[25:o3) = (E[2][(Y[2:o3 Is[2:0isi3)3 (r[2:o]P[2]) 

• E[23C(YC2:O3ls[2:0|Tt3)3(r[2:O]Q[2:o3), 

• E[253L(Y[2:03lst25R:03)3(F[25:i| A[L:03, a[r:o3, A [:03 13 (x[2:03)P[23) 

• BODY i 0 = 

CO[2:o3,r[2:o3) II (s[2:0],T[2:03,Ut25:o3). 

fcfc 1/ d c3. ~? 

• we(}C[l],We {L,R},hejo,1},i, j,ke{0,1} 

[■7 s — *<Dsm 1501 (Dmm\ 

£-UII£UI-1 ^t)-x— ^ DATA1I-1 ^glflX-Sc (U1 <DMt. <WHWI-S^l?"r 
— £ DATA1 1-1 =DATA1 0 &) 0 

if— $ ^(ommx <omm 1502 ommi 

£T UI-1 DATA1I-1 || BODY1I-1 || PROOF1I-1 || SIG1I-1 \\tfmb*lT k>. 

uiiiPRooFi 1 . .... proof ^<DiEmik%mmir% 0 ^(DjEm^ommiz-Di^xo 



60 



WO 2005/071640 



PCT/JP2005/001437 



UlteSIGH, .... SIG1I-1 <DlE^%m&irZ> 0 £ t>[Z RAND <Dj\v vn.it P 
^ftJtU P[2l=(e[|0|]+...+e[|K-1|])(1+n)P &o 
[U1 (Dfrft^tm 1504 <7)P$ffl] 

U1 te£"f\ SLife RAND RAND (D/\y vn-iit 



Pe6[l] 

tL, P[2]=(e[|0|]+...+e[|K-1|])P[2B]<!: Ls BODY1-1= RAND || P[2]<t L N fit 
BODY10 ^^rmB^-r^^JIKc^oTg^-e^L. S&U: PROOF10=SIG10=e 
t U DATA10=RAND||BODY10||PROOF10||SIG10 ^-So 
[SLil£j&1505 (DIM] 

ui is^ v^AicmT^ii^fcti Lt^^mm^mtc-r^ o IZM&Z. t) : 

• IxWliwhl]} (xKljwLtlO]]}^, 

x[0#1|w[t]0|]=l, 

x[#l|wh|]eK[l],^-x[#l|wh|]^if4e-y M£1) 0 

• MlwWh|]},x[|wWh|] e{0,1} (x[#HwLhl]Ox[#i|wRh|]=x[#l|wh|]) 
{w€=c[l],W€={L,R},he{0,l}i 

• r[2]={r[2lwWijk|]}GA[12], 

• r[21wWijk|]e=F p * CB[12] *=W[12], 

• s[2|Sl]={(s[2|S|])[|wWijk|]}eA[12], 

• s[2|T|]={(s[2|TH)[|wWiikl]}eA[12], 

• s [25U] = {s [25U I wW i j k I i [6] j [6] k [6] ] } e A [ 1 25] . 

• A[#l]=U[#l|w|]} (t£<yK<7>H, A [|w[t] |]=0) 

• y[#l]e F p c: K 

•wt : taxm* 

A^H^wCz^U ^5efi*JlCx[#l|L(w)0|]=x[#l|R(w)1|]=0 t^m-T^o 
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x[:i]=[x[:i|wWh|]}, 

x[2# 1 1 wWhl ]= 4> [2](x[#l |wWh|]), 

x[2#l]«{x[2#l]wWh|]|, 

x[2:l|WWh|]=^[2:]3(xtlwWhl]), 

x[2:i]={x[2:i|wWht]}, 
ABl]-UC#llw|3l, 

A[L#l]-UBllL(w)|]}, 
A[Rtl]-lA[#l|R(w)|]K 

a c: i iwi]«2 a c# y iw[], { y ^\<»mmmnitMz>) 

a[l:i]=|a[:I!L(w)|]}, 
A[R:i3-{A[:iiR(w)|]f, 
• Y[2:l]=(P[2],y[:l]P[23), 



B". # Ul (D&%t—$ BODY1I ttJSLT^^fe-To 

• BODY1I = (Q[2:l],r[2:!]) || (s[2:l],T[2:l],U[25:l]) s 

• (Q[2:l],r[2:l])=J[2](x[2:l))P[2],y[:l]P[2]). 

• (s[2:l],f[2:l],U[25:l])=(E[2][(Y[2:l]|s[2][S:l])](r[2:l]P[2]), 
E[2][(Y[2:ll|s[2:l|T|])](r[2:l]Q[2:l]), 

E[25][(Y[2:l]|s[25U:l])](F[25:l|A[L:l],A[R:l],A[:l]|](x[2:l])P[2]) 
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• sC2:i|S|] 

• s[2:l|T|] 

2s[2#y |T|], 

s[25U:l]= [235U:l]+s[25U#l], 
s[235U:l] 

F[25:IU[L#I], A [R#i], 

* s [25U : I -1 ] 

* F[25:ll0,0,0|](x[2#l]), 
[^It^15O6 0pfffl] 

ui bodyii ^tfwr^m^mmi-^o 
m^mo^mmotYM 1701] 
ui i££-f , 

• Q[2:l]=J[2]x[2#l])Q[2:l-1] 

• r[2:l]=y[#l]P[2]+r[2:l-1]^f+#-r £ » 

[t 1 — WW®: 1702] 

• S[23:l]=r[2#l]s[2:l-1] 

• T[23:i]=r[2#l]J[2](x[2#l])T[2:l-1] 

• U[235:l]=F[25:l|A[L#l],A[R#l],A[#l]|](1)*U[25:l-irF[25:i|0,0,0|](x[2#l]) 

• Q[2:l]=J[2](x[2:l])P[2]. 

• r[2:l]=y[:l]P[2K 

• S[23:l3=E[2][(Y[2:l-1]|s[2:I-1 [SjDKr^llPRl), 

. T[23:!]= E[2][(Y[2:l-1]|s[2:l-1|T|])](r[2:l]Q[2:l]), 

• U[235:l]=E[25][(Y[2:l-1]|s[235U:l])](F[25:l|A[L:l],A[R:l],A[:l]|](x[2:l])P[2]) 0 
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•s[235U:l]=F[25:l|A[L#l],A[R#l],A[#l]|](1) 
*s[25U:l-irF[25:l|0,0,0|](x[2#l]) 

[SB&#<b-W*«<Dfct!l 1703, #B£#te-£li£<Z)^l&1704, jE*HtefiESIiX<D# 
J& 1507. W^^CD^1508. t-*— £CDi^f 1509] 

•(1703)s[233:l]=S[23:l|1|],S[23:l|2|]+y[#l]s[2:l|1|]), 

T[233:l]=T[23:l|1 |],T[23:l|2|]+y[#l]T[2:l|1 U), 

■ 

T[2335:I]=(U[235:I|1 |],U[235:l|2|]+y[#l]U[25:l|1 1]), 
•(1704) 

s[2:l]=s[233:l]+E[2][(Y[2:l]|s[2#1|S|])](0), 

T[2:l]=T[233:!]+E[2][(Y[2:l]|s[2#1|T|])](0) 

U[235:l]=(U[235:l|1|],U[235:l|2|]), 

U[25:l]=T[2335:l]+E[25][(Y[2:l]ls[25U#l])](0), 

(s[2:l],T[2:l],U[25:IJ) 

=(E[2][(Y[2:!]|s[2:l|S|])](r[2:l]P[2]), 

E[2][(Y[2:l]|s[2:l|T|])](r[2:l]Q[2:l]), 

E[25][(Y[2:l]|s[25U:l])] 

(F[25:l][(AiL:l],A[R:l],A[:lll)](x[2:l]P[2]), 

•(1507) 

•(1508) 

■ BODY1l=s[2:l] ■ DATA1I-1 || BODY1M || PROOF1I-1 (Dm% 
SIG1I &ftm o 

•(1509)DATA1I=DATA1I-1 || BODY1I || PROOF1I || SIG1IDATA1I £ UI+1 

• S[23:l]=E[2][(Y[2:l-1]|s[2:l-1 |S|])](r[2:l]P[2]), 

• T[23:l]=E[2][(Y[2:l-1]|s[2:l-1|T|])](r[2:l]P[2]), 

• U[235:l]=E[25][(Y[2:l-1]|st25U:l-1])](r[25:l]P[2]), 
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• S[23:1]=(S[23:I|113,S[23:I|2]]), 

• T[23:I]=(T[23:I|1|],T[23:I|2|1), 

• T[23:I]=(T[23:I|1|],T[23:I|2|]), 

iEmwE.mw$:<Dftm 1507 omm^^co-^mm^mz^ip^-, 

DATA1l=(Q[2;l],r[2:l]) || (s[2:l],T[2:l],U[25:l])£ UI+1 \z&& 0 

•S[233:l] =E[2][(Y[2:l]|s[2:l-1|S|])](r[2:l]P[2]) N 

•s[2:IJ = E[2][(Y[2:l]|s[2:l|S|])](r[2:l]P[2]) 0 m 2 m @ <Otm<Dmm\ 

i"r—$(Dm% 1501 mmi 

#UI (£1)1-1 frh*r—$ DATA2l-1=DATA2l-2 || BODY2I-1 || PROOF2I-1 || SIG2I-1 

lT—5"P(DtEm$:(DWim. 1502^ =r— $ tp<DW%X<DW>m 1503, U1 (7Wt5 
a+S 1504. 3Lifc£j& 1505 ©Pi, Fp ±©B&-9-©jtttJ 1801] 

•(1502)PROOF21 || ... || PROOF2I-1 (D£M5l4;&EI(P*Bte&&)o 
•(1503)SIG21 || ... || SIG2I-1 (DIE^ttME 
•(1504)15J% L&Ln 
•(1505)^* L&l/* 

[#ftjt1506 £>P*ffl] 

n-ja @(©f+^:(D*f+s 1506 (DPm$gi 1 8 rzsij Lxmm-?& 0 

[Fp ±(Z>BS^-0>3ttH 1801] 
CKDSi-eii^^ I~:NJ 

•s[2U]=tt[23(s[25U]), 
•m[2S]= r[2], 
•m[2T]= r[2]J[2](x[2]), 
•m[2U]= F[25|A[L],A[R],A|](x[2]), 
•U[2]=tt[2](U[25]) 
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•(s[2],T[2],U[2]) 
=E[2][(Y[2]|s[2|S|])](m[2S]P[2]), 
E[23[(Y[2]|s[2|T|])](m[2T]P[2]), 
E[2][(Y[2]|s[2U])](m[2U]P[2J) 

•X={(P,x[|wh|]P)} s Y={(P,yP)}, 

• E[1][(r|X)](A)={E[7][(r[|wWijk[]|X)](A[|wWijk|]P)} 

• E[7] : *fR EIGamal Bt^^OBf^bP^o 
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• (s[24V|vyWijk|]=Zs[2VUwWijk|], (a IzmirZffiZmZ) 

m (m[24V|wWi jk|]=S2*m[2V]) [| aWWijkj], (a IZMT •S^EX-S) 

• (s[24V|wWijk|]P[2B||]=i:2«s[2V|arwWijkllP[2]), («* (CB5"T -£*n£Et3) 

• s [24V]P[2B]=(s [4V 10, wWi jk| ]P, s[4V| 1 , WWi jk| ]P) , 

• (m[24V|wWiik|]+(s[24V|wWijk|]y)P[2B] 

2 2 « m[2V| a wW i j k ! ]+s [2V| or WW i j k I ] ) yP[2B] ( a \zm ? -5 f n £ BR § ) 



• (s[2V|wWijk[3 

£s[2V| av*Wijk|]e[«] ( a tcHT 3*n£lK-§) 

• (s[24V|wWijk|]=((s[V|0,wWijk|], (s[V]) [| 1, wWi jk|]) 

• (m[2VjwWijk|]=m[2V|WWijk|] 

Zm[2Var |wWi jk|]e[| a |], (a C^1--S*a^li«) 

• m[24V|«Wijk|]=(m[4V|0,wWijk|],tn[4V|1,wWijk|]), 

• Pf2] 

S©[l«l3P[2B] UCirt&^lX-S) 

• P[2B]=(P,P), Pe{}G[1], 

• V[2] 

E[2][(Y[2]}s[2V])J(r[2]P[2]) 

1 s [2V] P [2] t m E2V] P [2] +s [2V] r [2] ) , 

• s[2V|wWi]k|]P[2] 

S(s[2V < r|wWijk|]e[U|3PC2B], (a tCgBf 3fa£Jfc3) 

• (m[2V|v»Wiik|]+s[2V|wWiik|] • y)P[2B] e W[12] 

2 (((m[2V]) [i a I]) [IwWi jk|]+s[2V| a \ Iwtfi jkl]yP[2B]e[| a [] 0 

• (m[24VjwWijk|3+s[24VjwWijk|]y)P[2B] 

(m[4V|0,wWijkl3+s[V|0,wWijk|]y)P, 
(fn[4V|1,wWijk|]+s[V|0,wWijk|]y)P 



•s[V|0,wWijk|]P. s[V|1,wWijk|]P, 
•m^VjO.wWijkn+slVIO.wWijkl^P, 
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m[4V| 1 ,wWijk|]+s[V|0,wWijk|]y)P, 

•R=yP s Y=(P,R) 

•(s[V|0,w\A/ijk|]P, 

(m[4V|0,wWijk|]+s[V|0,wWijk|]y)P 

=E[(s[V|0,wWijk|]|Y)](m[4V|0 1 wWijk|]P), 

•(S.T+U) 

=(E[3][(s[4S0],s[4T0]+s[4U0]|Y)],E[1][(r[40]|J(X))](F[|A[L] I A[R],A|](x)) 
•{(G[|wWijk|],0'[[wWijk|])} 

=E[3][(s[4S0],s[4T0]+s[4U0]|Y)],E[1][(r[40]|J(X))](F[|A[L],A[R],A|](x)) 

•0[&O]={(0[|wWijO|],0'[|wWijO|])} 

•R[&0]=R0 

•r[2]=R[|0|]+R[|1|] n 

[0l&1]<DttH 18O2,IE^t4liE0JS:CD^^ 1507 (OmmM^O)Wf& 1508 (DI$$B, 

-7 s — ^ omm 1509 <o&m 

•(1802) 

•0[&1]=0[&l-1H0[|O]][&l-1],0[|1|][&l-1]-y[&l]0[|O|][&l-1]), 
•BODY2f=0[&l] o 

•BODY2I-1=0[&I-1], 

•0[&I-1]=(0[&I-1][O],0[&I-1|1|]) 

•(1508) 

•(1803) 

• BODY2I = s[2:l] 

•SIG21 : DATA2I-1 || BODY2I || PROOF2I ^<Dm& 

^LT DATA2I=DATA2I-1 || BODY2I || PROOF2I || SIG2I £ UI+1 Ic^jf-T-S 
(1509) o 
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m 3 m a (Dtmcommi 

U M 7^£> DATA 3 m =DATA3I-2 || BODY3I || PROOF3I || SIG3I h>*lX &tz £ 

(1501), *y PROOF3 1 PROOF3I-1. SIG3U .... SIG3l-1(Z>IE^1t^«i^l 

■? & (1 502,1 503) „(1 504),(1 505)[*^ = JS @ ©ft#T?l*fc U„ BODY3l=e tL(1 506). 
PROOF3l=e £L(1507). fit DATA3I-1 || BODY3I || PROOF3I l^-T^W^ 
-SIG3I £ffr$L(1508K D ATA3 1= D ATA3 1- 1 || BODY3I || PROOF3I || SIG3I t U 
DATA3I £ Ul 13^^.(1 509) o 

[C[1]({b[|w|]»£3fta£>&:&& 1405] 
C[1]({b[|w|]»$3R«)-5^*BiWrSo 

*f X**^ w C^Lt x[#l|L(w)0|]=x[#l|R(w)1|]=0 fc £ (7) T? „ 
{E[1][(|{X[|W(w)i[|W|]|]})]x[|wWh[3](ij0)|])}^±rM#. Xx[|wWh[3](ij0)|]=x[|wWu[w]|] 
x[3|w|]=x[|w|j[w]|]=x[|wL|j[w]|]o{}x[|wR|j[w]|]^lt# Ls |j[w]=h[3](ij0) <fc -f<5o 

T^t. u-1 w ic^lt, xnijnwiJijTb^^o-r^^i-r 

&T<£>ftir£ LT u x[|M[|w|]|]£3fc«>£o 
•E[1][(|X[|L(w)n[|L(w)|]|])] 
(x[|{wWh[3](|j[|L(w)|]j0)}|]), 
E[1][(|X[|R(w)jj[|R(w)|]|])] 
(x[|wWh[3](i|j[|R(w)0)|]|]) (i,j=0,1) 

£ x[|W(w)M[|W(w)|]|]$ffior«< o 

•x[|wh[3] M [|L(w)|M|R(w)0|]|]= 

ox[|wWh[3]ML(w)|j[|R(w)0|]|] 

fcf£L:ct 
•h[3](iik)=h[|wl]((ioA[|L(w)|])(joA[|R(w)|])(koA[|wj])) 
•M[w]=b[|w|]oA[|w|]<»: L, 

•b[H] : m^-\M(omti 

•x[3|w|]=x[|w|j[w]l] 
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i-ffl g (Dtmco mmmm] 
[-m&(Dtm<oiEmmm<DW!$. 1507 omm] 

• ALl2|F p i3=*UaE2lwWi jk|3> IaC2|wWi jk)D ^F p } . 

• F[25:lia[|Oj3bClO|]c[|Ol3la[|1l3bC|1|]cC|1|]](u[2])eA[l2]^ 

F[25:l|abc|a[|6|M|6|]c[|6|33<u[2]) 

|x[2|h[:J|wa[|iOi[63l3b[|jOj[63l3c[|kOk[63l3l3l3(ijk)} 

• w : m^- 

• z[2]eK[123, 

• a[2]€=A[12], 

• a[253eA[1253, 

• a[|Ol3,a[Hl3,b[|0|3,b[|1l3,c[lO|3,c[|1l3,e F p , 

• u[2]eK[12], 

zmfi-eit. ff^^i? r : i-ij ^mm-tho 
^-rsLin ^/ \ v v =l mm iz i^x 

P[6]eG[1] 

•P[26B]=(1+n)P, 
•P[26]=IP[26B]e[|a|], (a IzHff 
•NOT(A)={NOT(A[|w|])} 
Ul te&TCD^JIire PROOF1I ^#J5K-r^o ^>^A^O-«|cmT(D-T— ^ £il 
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P [26#l|S[23]|]eA[12]2 

p[26#f|S[233]||2|]eA[12], 

p[26T[2&l]#l]€A[1232, 

p[26T[233]#l]eA[!2]2, 

p[26T[233]#l|2|]eA[12], 

P [246#l |T[233] I |2J] SA[12] 2 , 

/D[256#l|U[25&1]|]eA[l25]2 

jo[256#K A l3e=A[1253, 

/>[256#l|U[25&2]|]eA[l25], 

p[256#l|U[25&3]|]eA[l25], 

p[256#l|UE235:l]neA[125j 

/? [256#l 1TL2335: 1] | |2|]eA[12]. 

•C[2x[2]#l'|[|awWh|]|]=x[2#l|awWh|]P[2B]+(x[26#l|awWh|]P[26B],C[2x[2]#IHIe[|an 
C[2x[2]#l|[|awWh|]|]}[|wWh|J. (a (dlTT 

•C[2#!|S[23]|] = S[23:l] +p[26S[23]#l]P[26]j[S[23]#l]=p[26S[23]#l], 
•C[2S[23]#I]=(C[2S[23]#1|1|],(C[2S[23]#1])[|2|]) £ (C[2S[23]#I|1|],C[2S[23]#I|2|3) <!: 

C[y,C[2S[23]]#l|1|] 

yC[2S[23]#l|1 1] +p[26S[233]#l|2|]P[26||]{A[12]}, 

C[2S[233]#I]=(C[2S[23]#I|1|],C[2S[233]#I|2|3), 

C[2S[233]#l|2l]=C[2S[23]#l)2|]+C[2y,C[2S[23]]#l|1|], 
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t[S[233]#I]=(t[S[23]#I|1|], 
r[S[23]#l|2|]+yT[S[23]#l|1|]+p[26S[233]#l])c 

tcti L C CT?(t[S[23]#I|1|], t[S[23]#I|2|]) =(t[S[23]#I]) 0 
•C[2T[2&1 ]#I]=T[2&1 :l]+p[26T[2&1 ]#I]P[26] £ ,t[T[2&1 ]#l] = p[26T[2&1]#l], 
•C[2T[233]#I]=T[233:I] +p[26T[233]#l]P[26]j[T[233]#l]=p[26T[233]#l], 
•C[2T[23:l]#l]=(C[2T[23:l]#l|1|],C[2T[23:l]#l|2|])^(C[2T[23:l]#l|1|],C[2T[23:p^ 

C[y,C[2T[23:l]]#l|1j]=yC[2T[23:l]#l|1|] +p[26T[233]#l|2|]P[26A[12]], 
C[2T[233]#I]=(C[2T[23:I]#I|1|],C[2T[233]#I|2|]), 
C[2T[233]#l|2|]=C[2T[23:l]#l|2|]+C[2y,C[2T[23:l]]#l|1 1], 
t[T[233]#I]=(t[T[23:I]#I|1|], 
T[T[23:l]#lJ2i]+yT[T[23:l]#li1!]+p[26T[233]#l]) 0 

tzt=. L C Z1?(t[T[23:I]#I|1|]. t[T[23:I]#I|2|]) =t[T[23:I]#I] 0 
•K[2y,C[2T[233]]#l|1|]=y[4#l]C[2T[23:l]]+p[246T[233]#l|1|]P[26], 
•c[25U[25&1]#l]=U[25&1:l]+p[256#l)U[25&1]|]P[26],T[U[25&1]#l]=p[256#l|U[25&1]]] 0 
•C[2A#l]=A[#l]P[2]+p[256#l|A|]P, 

•p[256NOT(A)#l]=-p[256A#l],C[2NOT(A)#l]=P[2]-C[2A#l], 

•C[2U[25&2]#l]=F[25:l|A[L]{}00|NOT(A)[L]00](u[2])C[2U[25&1]#l]+p[256#l|U[25&2]|] 
P[26], 

tztz LilCt NOT(A)[L]={NOT(A)[|L(w)|]} 0 
T[U[25&2]#l]=F[25:l|A[L]{}00|NOT(A)[L]00](u[2])T[U[25&1]#l]+p[256#l|U[25&2]|], 
•C[2U[25&3]#l]=F[25:l|0A[R]0|0NOT(A)[R]0](u[2])C[2U[25&2]#l]+p[256U[25&3]#l]P[ 
26], 

NOT(A)[R]={NOT(A)[R|R(w)|]} 0 
T[U[25&3]#l]=F[25:l|0A[R]0|0NOT(A)[R]0](u[21)T[U[25&2]#l]+p[256U[25&3]#l] o 
•C[2U[235:l]#l]=F[25:l|00A|00NOT(A)](u[23)C[2U[25&3]#l], 
t[U[235:I]#I]=F[25:I|00A|00NOT(A)](u[2])t[U[25&3]#I], 
•C[2U[235:I]#I]=((C[2U[235:I]#I])[|1|],(C[2U[235:I]#I])[|2|])^ 
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(C[2U[235:I]#I|1 |],C[2U[235:i]#l|2|]) tm<o 

C[y,C[2U[235:l]]#r|1|]=yC[2U[235:l]#l|1|] +p[256#l|T[2335:l]||2|]P[26A[12]], 
C[2T[2335:I]#I]=(C[2U[235:I]#I|1|],C[2T[2335:I]#I|2|]), 
C[2T[2335:I]#!|2|]=C[2U[235:I]#I|2|] +C[2y,C[2U[235:l]]#l|1 1], 
t[T[2335:I]#I]=(t[U[235:I]#I|1|], 
T[U[235:l]#l|2|]+yT[U[235:l]#l|1|]+p[256T[2335:l]#l]), 

tztz L C C -^(t[U[235:I]#I|1 |] s t[U[235:I]#I|2|]) =t[U[235:I]#I] 0 

% x[2| «wWh!]P[2B]=l(Dfl#o 



i;-f ^>^ACCx[246&1 1 <*wWh j ] ^B[l] £H 
t>\ K[2&1|*wWh|]= 
x[246&1 | <*wWh|]P[26B] 

x[29&7? I «rwWh|], 
x[29&? | *wWh|3P[26] 

-c [2& ?7 | a wWh | ] (C [2x [2] I or wWh | ] - rj P [2B] ) £ 
•x[2|awWh|]P[2B]=n C0B# o 
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£1* 7>#ACx[246& J7 |«wWh|]eB[1]=&M 

t>\ K[2&7 I «wWh|]= 

x[246& 7 I «wWh!]P[26B3 fcltg-t-So 

x[29&1 1 orwWhl ] , c[2&l | orwWh | ] 

sb[i] tatf, 

KC2&1 1 «wWh|]=x[29&1 1 awWh|]P[26] 
-c[2&1 1 ffuNhl] (C[2x[2] I «wWh|]-P[2B]) * 

(K[2&1|orwWh|], 

(K [2& 7 U wWh | ] ft 1+ g f § c 
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x[24#lL x[246#l] e A[12], 
y[4#l]e F p , 

r [24#l]eA[12F p ]. 
pt246S[23]#l]^A[12]2, 

/>[246S[233]#j|2]]eA[12]2, 

s[24S#l]eA[l25] s r [4S[233]#I]GA[125]2 

r[24#l]€=A[12F p L 
p[246TC2&1]#l]eA[l23 2 , 

p[246T[233]#l]eA[l2]2, 

s[24T#l]eA[125]. t [4T[233]#I]6=A[125]2, 

/o[2456U[25&11#l] 
^ A[125]2, 

p [2456 Afi]€A[1253, 
A[4#l]eF p , 

N0T(A)[4#I], 

{N0T(A)[4#l|w|]}, 
N0T(A)[#l|w|] 

S F P' 

p[2456UC25&2]#l]e A[125], 
p [2456T [2335 : 1 ] # I J 2 1 ] e A [ 1 2 ] 2 , 
s[245U#l]€=A[1253. r [4T[2335: <=A[125]2, 

•K[2x[2]#l]=x[24#l]P[2]+x[246#l]P[26], 
•K[2J[2Kx) I Q[2]#l]=J[2](x[24])Q[2], 
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K[2y#l]a*y[4#l]Pe= F p C B[1], 

• K[2r[2],s[2]#l]=r[24#l]s[2]+p[246S[23]#l]P[26], 
•K[2y,C[2S[233]]#l|1|]=y[4#l]C[2S[23]]+p[246S[2333#l|1|]P[26], 

• K[2s[24S]#l]=s[24S#l]Y[2]-T[4S[233]#!]P[26], 

• K[2r[2],T[2]#l]=r[24#l]T[2]+p[246T[2&13#l]P[26], 

• K[2J[2](x[2]),T[2&1]#l]=J[2](x[24#l])T[2&1]+p[246T[233]#l]P[26], 

• K[2s[24T]#l]=s[24T#l3Y[2]-T[4T[233]#l]P[26], 

•K[25U[25&1]#!] =U[25:l-1]*F[25:l|0,0,0|](x[24#l])+p[2456U[25&1]#l]P[26] ! 

•K[2A,P[2]#l]=A[4#l]P[2]+p[2456A#l]P[26],K[2A,C[2A]#i]=A[4#l]C[2A#l]+p[2456A#l]P[ 

26], 

•A[4L#l]={A[4#l|L(w)|]},NOT(A)[4L^ 
00|NOT(A)[4L]00](1)*U[25&1]+p[2456U[25&2]#l]P[26], 

•A[4R#l]={A[4#l|R(w)|]},NOT(A)[4R#l]={NOT(A)[4R(w)#l]},K[2U[25&3]#l]=F[25:l|0A[4 
R]0l0NOT(A)[4R]0](1)*UI25&2]+p[2456U[25&3]#l]P[26], 

•A[4R#l]={A[4R(w)#l]},NOT(A)[4R#l]={NOT(A)[4R(w)#l]},K[2U[235:l]#l]=F[25:l|00A[4] 
|00NOT(A)[4]](1 )*U[25&3], 

•K[2y,C[2T[2335.i]]#l|1|]=y[4#l]C[2U[235:l]]+p[2456T[2335:l]#l|1|]P[26], 
•K[2s[245U]#l]=s[245U#l]Y[2]-T[4T[2335:l]#l]P[26], 

c[#!]=Hash(DATA1l-1,BODY1!,C[2x[2]#l],C[2S[23]#l],(C[2S[23]#l|1|],C[2S[23]#l|2|]), 

C[y,C[2S[23]]#l|1|],C[2T[2&1]#l],C[2T[233]#l],(C[2T[23:l]#l|1|],C[2T[23:l]#l|2|]),C[^^^ 

233]#l],K[2s[24T]#l]=s[24T#l]Y[2]c[25U[25&1]#l] ) C[2A#l],C[2NOT(A)#l],C[2U[25&2] 

#l],C[2U[25&3]#l],C[2U[235:l]#l],(C[2U[235:l]#l|1|] ) C[2U[235:l]#l|2|]) J C[y,C[2U[235:l] 

]#l|1|],C[2T[2335:l]#l|2|],K[2&1|aw^^ 

K[2y#l],K[2r[2],s[2]#l] > K[2y,C[2S[233]]#!|1|] I K[2s[24S3#l] ) KI2r[2]T[2]#l],K[2J[2](x[2]) I 
T[2&1]#I],K[25U[25&1]#I],K[2A,P[2]^ 

2U[235:l]#l],K[2y,C[2T[2335:l]]#l|1 |],KI2s[245U3#l],)£ltS-f £ o 
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fcfcLC-T? Hash li. Fp tt/\«y*/a.Htt. 

•x[2(awWh|]P[2B]=1 <£>B# 0 

awWh f^xtf c[2&1 |awWh|]=c[#l]-c[2&n|awWh|] £: L % 
x[29&1 |awWh|]=c[2&1 |awWh|](x[26|a|])[|wWh|]+x[246&1 |awWh|] ^I+® 0 
•x[2|awWh|]P[2B]=n <DB# 0 

•# awWh [z^fLs c[2&n|awWh|]=c[#l]-c[2&1|awWh|]<h L, 
x[29&n|awWh|]=c[2&n|awWh|](x[26|a|])[|wWh|]+x[246&n|awWh|]^fi^: 
(c[#l]c[2&1 |awWh|],x[29&1 |awWh|]),c[2&n|awWh|] ,x[29&n|awWh|]))-r 3 o 

•x[28#l]=c[#l]x[2#l]+x[24#l] ,x[268#l]=c[#l]x[26#l]+x[246#l], 
•y [8#l]=c[#l]yP] + y[4#l] , 

•r[28#l]=c[#l]r[2#l]+r[24#l],p[268S[23]#l]=c[#l]p[26S[23]#l]+p[246S[23]#l], 
•r[8#l]=c[#l]r[2#l]+r[24#l],p[268S[233]#l|2|]=c[#l]p[26#l|St2333||2|3+p[246S[233]#l|2| 

]. 

•s[28S#l]=c[#l]s[24S#l]+s[24S#l]. t[8S[233]#I]=c[#I]t[S[233]#I]+t[4S[233]#I], 
• r[28#l]=c[#l]r[2#l]+r[24#l],p[268T[2&1]#l]=c[#l]p[26T[2&1]#l]+p[246T[2&1]#l], 
•p[268T[233]#l]=c[#l]p[26T[233]#l]+p[246T[233]#l], 

•r[8#l]=c[#l]r[2#l]+r[24#l],p[268T[233]#l|2|]=c[#l]p[26T[233]#l|2|]+p[246#l|T[233]||2|] 

•s[28T#l]=c[#l]s[24T#l]+s[24T#l], t[8T[233]#I]=c[#I]t[T[233]#I]+t[4T[233]#I], 
•p[2568U[25&1 ]#l]=c[#l]p[256U[25&1 ]#l]+p[2456U[25&1 
•A[8#l]=c[#l]A[#l]+A[4#l],p[2568A#l]=c[#!]p[256A#l]+p[2456A#l], 
•NOT(A)[8#l]=c[#l]NOT(A)[#l]+NOT(A)[4#l] 

p[2568U[25&2]#l]=c[#l]p[256U[25&2]#l]+p[2456U[25&2]#l]P[26], 
•p[2568U[25&3]#l]=c[#l]p[256U[25&33#l]+p[2456U[25&31#l]P[26], 
•r[8#l]=c[#l]r[2#l]+r[24#l],p[2568T[2335:!]#!|2|]=c[#l]p[256T[2335:l]#l|2|]+p[2456T[2 
335:l]#l|2|], 

•s[258U#l]=c[#l]s[245U#l]+s[245U#l] 
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Tt8T[2335:l]#l]=c[#l]T[T[2335:l]#l]+T[4T[2335:l]#l]o 
fit, 

PROOF1 l=(C[2x[2]#l],C[2S[23]#l],(C[2S[23]#l|1 |],C[2S[23]#l|2|]),C[y,C[2S[23]]#l|1 1], 
C[2T[2&1]#l],C[2T[233]#l] ) (C[2T[23:l]#l|1|],C[2T[23:l]#l|2|]),C[2T[233]#l],c[25U[25& 
1]#l],C[2A#l],C[2NOT(A)#l],C[2U[25&2]#l],C[2U[25&3]#l],C[2U[235:l]#l],(CE2U[235:l] 
#l|1 |],C[2U[235:l]#l|2|]),C[y,C[2U[235:l]]#l]1 H.C^TiasSSilltfliail.^&l |cnAA^h|] > K[2& 
■ n|awWh|],K[2x[2]#l],K^ 

2s[24S]#l],K[2r[2],T[2]#l],K[2J[2](x[2]),T[2&1]#l],K[2s[24T]#l] ) K[25U[25&1]#l],K[2A ) P 
[2]#l],K[2A 1 C[2A]#l] ) K[2U[25&2]#l],K[2U[25&3]#l],K[2U[235:l]#ll,K[2y ) C[2T[2335:!]]#l| 
1 |],K[2s[245U]#l],c[#l],x[29&1 |awWh|]),x[29&n|awWh|])),x[28#l] ,x[268#l],y[8#l],r[28 
#l],p[268S[23]#l]r[8#l]p[268S[233]#l|2|]s[28S#l]r[28#l]p[268T[2&1]#i]p[268T[233]#l] 
r[8#l]p[268T[233]#ll2|]p[2568U[25&1]#l],A[8#l] ,p[2568A#l] ,NOT(A)[8#l],p[2568U[25 
&2]#l],p[2568U[25&3]#l],r[8#l]p[2568T[2335:l]#l|2|]s[258U#!]) h~t%> 0 

{-m&(Dt\w<DiEm±m.w<Dmk 1502 ommi 
proofii ^sitixofce>. ui+i it&rF&mm-t&o 

• 

c[#l]=Hash(DATA1 1-1 ,BODY1 l,C[2x[23#l],C[2S[23]#l],(C[2S[23]#l|1 |3,C[2S[23]#I|2|]), 
C[y,C[2S[23]]#l|in,C[2T[2&1]#l],C[2^ 

233]#l],K[2s[24T]#l]c[25U[25&1]#l],C[2A#l],C[2NOT(A)#l],C[2U[25&2]#l],C[2U[25&3 
]#l],C[2U[235:l]#l],(C[2U[235:l]#l|1|],C[2U[235:l]#l|2|]),C[y,C[2U[235:l]]#l|1|],C[2T[23 
35:l]#l|2|],KE2&1lGMfWh|].K[2&n|oravWh|].K[2^ 

s[2l#l] I K[2y,C[2S[233]]#l|1|],K[2s[24S3#l],K[2r[2] ) T[2]#l],K[2J[2](x[2]),T[2&1]#l3,K[25 

U[25&1]#I],K[2AP[2]#I],K[2A,C[2A^^ 

2y,C[2T[2335:l]]#l|1|],K[2s[245U]#l] ( ), 

awWh fc*t U &LTtfmtLir%m o 
•c[#l]=c[2&1|awWh|]+c[2&n|awWh|] ,x[29&1 |awWh|] P[6B] 

=c[2&1 |awWh|](C[2x[2]|awWh|]-P[2B])+K[2&1 |awWh|],x[29&1 |awWh|] P[6B] 
=c[2&n|awWh|](C[2x[2]|awWh|]-nP[2B])+K[2&n|awWh|] 
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x[28ftl]P[2]+x[28#l]P[26] = 
cCfllCKxMtll+KfexKitl], 

J[2](x[28#l])Q[2#l] = JC2](c[#l])Q[2#l]+K[2J[2](x),Q[2]#l], 
y[8#l3 e F p , 

y[8tlM2] =ct#l]<r[2:l]-r[2]) +K[2y#l], 
y[8#l] e F p , 

r[28#l]st2:l-1] 
+ 

p[268S[23]ftl3PC263 

c[#l]C[2S[23]#l] + K£2r[2],s[2]#l], 

c[tl]C[2y,C[2St23]]Sin|] 
+ 

K[2y,C[2S[2333tl M 13 

y[8#l]C[2SC233#il21] 
+ 

p [268S[233]#1 ]213P[26A[12]3, 



c[#l3(s[2#l]-C[2S[2333tl3) 
+ 

K[2s[24S3#l3 

s[28sfti]y[:i3 

r[8S[2333#I]P[2], 

r[28#l]T[2:l-l] 
+ 

p[268T[2&l3ftl]P[263 

c[#l]C[2T[2&1]#|] + KE2r[23,T[23#l3, 

J[2] (xE28#l])T[2&1:l-t] 
+ 

p[268T[2333#l3Pt263 

C[#I3C[2T[2333#I3 + Kr2r[23,T[2&l3#l], 

c[#l3c[2y,c[2Tt23:i33#l|l|3 
+ 

K[2y,C[2T[23:n]#l|1|] 

y[8#|]C[2T[23:l3#il2|] 

+ 

p [268T[2333#I l2l3P[26A[/!233, 



79 



WO 2005/071640 



PCT/JP2005/001437 



c[#l](T[2ttl]-C[2T[233]#l]) 
K[2s[24T]#l] 
s[28T#l]Y[:l] 
r [8T[233]#I]P[2], 
r[28#l3^A[12F p ], 

U[25: l-1]*F[25: 1 [0,0,0|] (x[28#l]) 
+ 

p[2568U[25&1]#l]PC26] 

c[#l]c[25U[25&1]#l] 
+ 

K[25U[25&1]#l3, 

#wWijk,i[6], j[6],k[6]CMb 
A[8#l|wWijk|i[6],j[6],k[6]]e F p ^4^*, 

A[8#l]P[2]+p[2568A#l]P[26]=c[#l]C[2A#l]+K[2A,P[2]#l],A[8#l]C[2A#l]+p[2568A#l]P[26] 

=c[#l]C[2A#l]+K[2A,C[2A]#i], 

•C[2NOT(A)#l]=P[2]-C[2A#l], 

•c[#l]C[2U[25&2]#l]+K[2U[25&2]#l]=F[25:l|A[8L]00|NOT(A)[8L]00](1)*U[25&1]+p[25 
68U[25&2]#I]P[26], 

•c[#l]C[2U[25&3]#l]+K[2U[25&3]#l]=F[25:l|A[8R]00|NOT(A)[8R]00](1)*U[25&2]+p[2 
568U[25&3]#I]P[26], 

•c[#llC[2U[235:l]#l]+K[2U[235:l]#l]=F[25:l|{00A[8]|00NOT(A)[8]](1)*U[25&3l, 

•c[#l]C[2y,C[2U[235:l]]#l|1|]+K[2y,C^ 

T[2335:I]#I|2|]P[26A[12]], 

•c[#l](U[2#ll-C[2T[2335:l]#l])+K[2s[245U]#l]=s[258U#l]Y[:l]-Tl8T[2335:l]#l]P[2]o 
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Ul (£^>#A[C 

y [4&l] e F p 

£5St£. &T<D& 9 I- Lt PROOF2I ^ttlt &o 
•P[4&l]=y[4&l]P,0[4&l|1 |]=y[4&l]0[&l|1 1], 
•c[&l]=Hash(DATA2l-1 || BODY2l-1|| P[4&l] || ©[4&I]), 

• y[8&l]=c[&l]y[&l]+y[4&l], 

• PROOF2l=P[4&l] || 0[4&l]|| c[&l] || y[8&l] Q 

[ - m i (Dtm^iEm^mmomiS: 1502 <dp*h] 

PROOF1I ^gttlJlofct). UI+1 l£kTF£flill&-3~<£>o 

• y[8&l]P=c(R[:l]-R[:M]})+P[4] 

•y[8&l]0[8&l-1 |O|]=c(0[&l-1 |O|]-0[&I|O|])+0[4&I-1 10|] 
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1=^(6 LT^LfcWft*© EIGamal B&#S:(D*^"efc L J > 
flfS EIGamal l©#S:^^-rSa)I=fflt^fc^Mfil*. C0>?— Hz^ttZtLZ 

5 . mmmm 2 fcfBS^f-i+if 

HiriBAMSi: Its #ttS^aic EIGamal B^^xCOMHIc^^A^-r 
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£ j£-T £ A* (D f— h 4*Bfl«<D IE ia ttcDKEBj £ j&x =rvZ?h, 

HuaBA^KD^- h^P^CDIE^ficDliB^^X^ *y ^[cT^filt L A2Jtf><kP?fl$i 

^B^±i^L7i:>f— hWH^Bt^b-T-Sy- hWl^B^b^f'^.!:, 

BUIE^- K^^M<DB^S:cDIE^'!4liE0^^^ii!t-r^^- MM£l<Z>Bi-*§-:*:0>IE 
^14a)llB^^/tx^ z?£ . 
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